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IN THE CLAIMS 
Amended claims follow: 

1 . (Currently Amended) A method for recognizing virus signatures, comprising 

(a) identifying a list of virus signatures; 

(b) combining the list of virus signatures into a tree of virus signatures; and 

(c) comparing data against the tree of virus signatures for virus signature 
recognition; 

wherein the virus signatures each include a sequence of characters; 

wherein the tree includes a plurality of branches each including a sequence of 

characters; 

wherein a portion of the branches corresponds to a plurality of the virus 
signatures; 

wherein the efficiency of the virus signature recognition is improved by 
reducing an amount of virus signature data that is compared against the data; 
wherein the branches include further sub-branches each corresponding to at least 
one virus signature; 

wherein the branches include upper branch portions and lower branch portions; 
wherein a poi nter associated with a node of the tree is removed, if only one 
pointer exists, and an internal data structure includes a flag to indicate such 
removal . 

2.-6. (Cancelled) 

7. (Previously Presented) The method as recited in claim 1 , wherein the characters 
include wildcards. 
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8. (Previously Presented) The method as recited in claim 1 , wherein the characters 
of the tree of virus signatures are obfuscated to prevent detection by the 
comparison. 

9. (Cancelled) 

10. (Previously Presented) The method as recited in claim 1 , wherein the comparing 
includes comparing the data against the upper branch portions of the tree. 

1 1 . (Original> The method as recited in claim 1 0, wherein the comparing further 
includes, comparing the data against the lower branch portions of the tree if the 
data was successfully compared to the upper branch portions associated with the 
lower branch portions. 

12. (Original) The method as recited in claim 1 1, wherein a virus signature is 
determined to be recognized upon the successful comparison of the data against 
an entirety of at least one branch that includes all of the characters of one of the 
virus signatures. 

13. (Original) The method as recited in Claim 1 1, wherein data is eligible to be 
declared clean upon the unsuccessful comparison of the data against an entirety 
of at least one branch that includes all of the characters of one of the virus 
signatures. 

14. (Currently Amended) A computer program product embodied on a computer 
readable medium for recognizing virus signatures, comprising 

(a) computer code for identifying a list of virus signatures; 

(b) computer code for combining the list of virus signatures into a tree of virus 
signatures; and 
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(c) computer code for comparing data against the tree of virus signatures for virus 
signature recognition; 

wherein the virus signatures each include a sequence of characters; 

wherein the tree includes a plurality of branches each including a sequence of 

characters; 

wherein a portion of the branches corresponds to a plurality of the virus 
signatures; 

wherein the efficiency of the virus signature recognition is improved by 
reducing an amount of virus signature data that is compared against the data; 
wherein the branches include further sub-branches each corresponding to at least 
one virus signature; 

wherein the branches, include upper branch portions and lower branch portions; 
wherein a poi nter associated with a node of the tree is removed, if only one 
pointer exists , and an internal data structure includes a flag to indicate such 
removal . 

15.-19. (Cancelled) 

20. (Previously Presented):The computer program product as recited in claim 14, 
wherein the characters include wildcards. 

21 . (Previously Presented) The computer program product as recited in claim 14, 
wherein the characters of the tree of virus signatures are obfuscated to prevent 
detection by the comparison. 

22. (Cancelled) 
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23. (Previously Presented) The computer'program product as recited in claim 14, 
wherein the comparing includes comparing the data against the upper branch 
portions of the tree. 

24. (Original) The computer program product as recited in claim 23, wherein the 
comparing further includes comparing the data against the lower branch portions 
of the tree if the data was successfully compared to the upper branch portions 
associated with the lower branch portions. 

25. (Original)-The computer program product as recited in claim 24, wherein a virus 
signature is determined to be recognized upon the successful comparison of the 
data against an entirety of at least one branch that includes all of the characters 
of one of the virus signatures. 

26. (Original) The computer program product as recited in Claim 24, wherein data is 
eligible to be declared clean upon the unsuccessful comparison of the data 
against an entirety of at least one branch that includes all of the characters of one 
of the virus signatures, 

27. (Currently Amended) A system for recognizing virus signatures, comprising 

(a) logic for identifying a list of virus signatures; 

(b) logic for combining the list of virus signatures into a tree of virus signatures; and 

(c) logic for comparing data against the tree of virus signatures for virus signature 
recognition; 

wherein the virus signatures each include a sequence of characters; 

wherein the tree includes a plurality of branches each including a sequence of 

characters; 

wherein a portion of the branches corresponds to a plurality of the virus 
signatures; 
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wherein the efficiency of the virus signature recognition is improved by 
reducing an amount of virus signature data that is compared against the data; 
wherein the branches include further sub-branches each corresponding to at least 
one virus signature; 

wherein the branches include upper branch portions and lower branch portions; 
wherein a pointer associat ed with a node of the tree is removed, if only one 
pointer exists, and an inter nal data structure includes a flap to indicate such 
removal . 

28. (Currently Amended) A method for recognizing virus signatures with improved 
efficiency, comprising 

(a) identifying a list of virus signatures each including a sequence of characters; 

(b) combining the list of virus signatures into a tree of virus signatures including a 
plurality of branches each including a sequence of characters, wherein at least a 
portion of the branches includes upper branch portions and lower branch 
portions; 

(c) obfuscating the sequence of characters in the tree of virus signatures; 

(d) comparing the data against the upper branch portions of the tree; 

(e> comparing the data against the lower branch portions of the tree if the data was 
successfully compared to the upper branch portions associated with the lower 
branch portions; 

(f) declaring a virus signature to be recognized upon the successful comparison of 
the data against an entirety of at least one branch of the tree that includes all of 
the characters of one of the virus signatures; and 

(g) determining that the data is eligible to be declared clean upon the unsuccessful 
comparison of the data against an entirety of at least one branch of the tree that 
includes all of the characters of one of the virus signatures; 

wherein a portion of the branches corresponds to a plurality of the virus 
signatures; 
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wherein the efficiency of the virus signature recognition is improved by 
reducing an amount of virus signature data that is compared against the data; 
wherein the branches include further sub-branches each corresponding to at least 
one virus signature; 

wherein a pointer associated with a node of the tree is removed, if only one 
pointer exists, and an internal data structure includes a flag to indicate such 
removal . 

29. (Previously Presented) The method as recited in claim 8, wherein the 
obfuscation prevents accidental self-detection of the tree of virus signatures. 

30. (Previously Presented>The method as recited in claim 29, wherein the 
obfuscation is accomplished utilizing an exclusive-OR operation. 

3 1 . (Previously Presented) The method as recited in claim 1 , wherein pre-processing 
is performed prior to use of the tree of virus signatures. 

32. (Previously Presented) The method as recited in claim 31 r wherein the pre- 
processing includes finding a correct location in a file where a virus resides, 
decryption, and emulation. 

33. (Previously Presented) The method as recited in claim 1 , wherein the virus 
signature recognition is improved since comparison of similar portions of the 
virus signatures with the data more than once is avoided. 

34. (Cancelled) 



- PAGE 1 0/1 1 * RCVD AT 7/7/2005 4:31 :45 PM [Eastern Daylight Time] * 8VR:USPTO-EFXRF-1/5 * DNIS:8729308 " C8ID:408 971 4060 * DURATION (mm-$s):03-40 



